Toward Quantum-Resilient PKI: A Systematic Literature Review of Post-Quantum Certificates Model

The rise of quantum computing presents a critical threat to classical public-key cryptographic systems, necessitating a global shift toward post-quantum cryptography (PQC). While algorithmic standardisation has seen substantial progress since the National Institute of Standards and Technology (NIST) initiated its call for PQC proposals in 2017, the integration of these algorithms into certificate-based infrastructures remains fragmented and underexplored. This gap creates uncertainty for secure communication, particularly in transitioning legacy systems into quantum-resilient environments. This systematic literature review (SLR) focuses on PQC certificate architectures studied between 2017 and 2025, encompassing the evolution of the field since NIST's formal standardisation efforts began. The review employs the PRISMA 2020 methodology to identify and analyse six distinct post-quantum certificate models: Pure PQC, Hybrid, Composite, Chameleon, Parallel, and Wrapped. Each model is evaluated across several criteria, including structure, backwards compatibility, tooling support, standardisation status, and production readiness, drawing evidence from scholarly publications, draft standards, and open-source implementations. Findings highlight the Hybrid certificate as the most viable short-term solution due to its high interoperability and maturity in deployment. Composite and Parallel architectures offer enhanced security assurances that are suitable for critical infrastructure, although they come with increased implementation complexity. Pure PQC certificates, while future-proof, are still limited to constrained or greenfield environments. Chameleon and Wrapped models are identified as emerging alternatives for blockchain and legacy scenarios, respectively, with limited but growing support. This review enlightens the design and deployment of quantum-safe public key infrastructures by outlining the trade-offs and maturity levels of each architecture. It also emphasises the need for continued development in standardisation and toolchain support to facilitate scalable and secure PQC adoption.